CVE-2026-49495: Ghidra Denial of Service via Malicious Mach-O Export Trie

Technical summary

CVE-2026-49495 is an uncontrolled resource consumption vulnerability in the ExportTrie.parseTrie() function within Ghidra versions 10.2 through 12.0. The vulnerability arises from insufficient cycle detection when traversing Mach-O binary export tries. A maliciously crafted Mach-O binary containing circular references in the export trie data structure triggers unbounded queue growth and pathological string concatenation during parsing. This exhausts heap memory, ultimately causing an OutOfMemoryError that crashes the JVM process hosting the Ghidra analysis session. The underlying weakness is classified as CWE-835 (Loop with Unreachable Exit Condition).

Business impact

For security teams and reverse-engineers relying on Ghidra for malware analysis, firmware inspection, and vulnerability research, this vulnerability introduces operational risk. Opening an untrusted or compromised Mach-O binary—whether discovered in the wild, received from a partner, or obtained during incident response—can abruptly terminate Ghidra and destroy the analyst's working session and unsaved analysis notes. In environments processing high volumes of binaries or conducting time-sensitive investigations, this denial-of-service effect can disrupt workflow, delay threat assessment, and reduce analyst productivity. The impact is amplified in organizations lacking disciplined checkpointing and version control practices for analysis work.

Affected systems

Ghidra versions 10.2 through 12.0 are affected. Organizations using Ghidra 12.1 and later are not vulnerable. The vulnerability is specific to parsing Mach-O binaries (the executable format used by macOS and iOS); analysis of other binary formats (ELF, PE, COFF) is unaffected. Any deployment of Ghidra—whether standalone on analyst workstations, integrated into automated analysis pipelines, or running in containerized environments—can be targeted if it processes untrusted Mach-O files.

Exploitability

Exploitation requires user interaction: an analyst must open a crafted Mach-O file within Ghidra. There are no prerequisites for authentication or elevated privilege. The attacker's capabilities are limited to denial of service; the vulnerability does not permit code execution, information disclosure, or persistence. From an attacker's perspective, the barrier to exploitation is low—constructing a Mach-O binary with a circular export trie is a well-defined programming task—but the attack only succeeds if the target analyst processes the malicious file. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild as of the publication date.

Remediation

Update Ghidra to version 12.1 or later. NSA's Ghidra releases are available from the official GitHub repository and through integration with package managers in some Linux distributions. Organizations should validate the integrity of downloaded releases using cryptographic signatures provided by NSA. As an interim mitigation, organizations unable to upgrade immediately should restrict analysis of untrusted Mach-O binaries to isolated, sandboxed environments and implement process monitoring to detect memory exhaustion; however, this does not prevent the crash itself, only limits collateral damage. Analysts should enforce a discipline of frequently saving work to version control or automated snapshots.

Patch guidance

Verify that your deployment is running Ghidra 12.1 or later. Check the version displayed in Ghidra's Help > About menu or via command-line flag (ghidra_10.1.0/bin/ghidra --version or equivalent). Download the patched release from the official NSA Ghidra GitHub releases page and follow NSA's documented installation procedure for your operating system (Windows, Linux, macOS). If you have customized Ghidra plugins or scripts, test them against the new version in a non-production environment before full deployment. For organizations using Ghidra as part of an automated analysis pipeline or container image, rebuild your container image and redeploy to all instances.

Detection guidance

Monitor for OutOfMemoryError crashes in Ghidra processes, especially correlating crash timestamps with loading of Mach-O binaries. Analyze Ghidra's debug logs (enable verbose logging via Ghidra's preferences if available) for repeated warnings about export trie traversal or memory pressure. In sandboxed or containerized environments, observe process resource graphs for sudden, sustained memory consumption spikes that precede process termination. If Ghidra is integrated into an automated pipeline, instrument the pipeline to catch non-zero exit codes from Ghidra child processes and log the binary file that triggered the failure. Retroactively, you cannot easily detect if an analyst opened a malicious binary (unless process execution logging captured the file path), but you can detect the crash event itself in system or application logs.

Why prioritize this

This vulnerability merits timely patching because it affects a widely-used open-source security analysis tool, the barrier to crafting a malicious Mach-O is low, and the impact on analyst productivity is direct and obvious. However, its CVSS score of 5.5 (Medium severity) and the requirement for user interaction mean it should not displace critical or high-severity vulnerabilities from the patch queue. Prioritize this upgrade if your organization regularly analyzes Mach-O binaries (e.g., teams focused on iOS or macOS malware, security firmware analysis) or if Ghidra crashes have already been observed in production. For organizations analyzing primarily Linux or Windows binaries, this can be addressed in the next quarterly patch cycle.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity profile with an important caveat: the score assumes 'User Interaction Required' (UI:R) and measures impact only as availability loss (A:H). Attack Vector is Local (AV:L), meaning the attacker must place or socially engineer delivery of a malicious file to the target. Attack Complexity is Low (AC:L)—constructing the malicious Mach-O is straightforward. Confidentiality and Integrity are unaffected (C:N, I:N). The score accurately captures denial of service to a single analyst's session but does not quantify the organizational workflow disruption, loss of analysis notes, or incident response delays. In security-critical environments, the contextual risk may exceed the base CVSS score.

Frequently asked questions